🤖 TL;DR If you save over a file by accident on Windows, and you had System Protection or backups enabled, VSS probably created a shadow copy — a hidden snapshot of your file from earlier. ShadowExplorer gives you an easy, GUI-based way to browse and export those previous versions. No time machine needed 🤗! The
CategoryBlue Team
EDR internals
Understand how an EDR is built with this wonderful illustration
Install Volatility Everywhere ( Docker & Standalone)
Standalone, Dockerfile and docker-compose to run volatility 2 in a docker container for easy forensic analysis
How to choose your EDR solution ?
Learn how to select the right Endpoint Detection and Response (EDR) to enhance your organization’s security posture.
🤖 Volatility 3 – Windows | Cheatsheet (FR)
Une liste de modules et de commandes pour analyser les dumps mémoire Windows avec Volatility 3.
Protéger un PC Windows volé (à distance)
Comment protéger les données d’un poste windows volé. Nécessite un accès à distance à la machine.